CVE-2022-28247: Adobe Acrobat Uninstaller Hard Link Leads To Remote Code Execution
First published: Wed May 11 2022(Updated: )
Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an uncontrolled search path vulnerability that could lead to local privilege escalation. Exploitation of this issue requires user interaction in that a victim must run the uninstaller with Admin privileges.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Dc | >=15.008.20082<=22.001.20085 | |
| Adobe Acrobat Reader DC | >=15.008.20082<=22.001.20085 | |
| Apple macOS | ||
| Microsoft Windows | ||
| Adobe Acrobat Reader | >=17.011.30059<=17.012.30205 | |
| Adobe Acrobat Reader | >=17.011.30059<=17.012.30205 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30314 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30314 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30311 | |
| Adobe Acrobat Reader | >=20.001.30005<=20.005.30311 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-28247.
What is the severity of CVE-2022-28247?
The severity of CVE-2022-28247 is high with a CVSS score of 7.3.
Which software versions are affected by CVE-2022-28247?
Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier), and 17.012.3022x (and earlier) are affected.
How can CVE-2022-28247 be exploited?
Exploitation of CVE-2022-28247 requires user interaction in that a victim must run a malicious file or program.
Where can I get more information about CVE-2022-28247?
You can find more information about CVE-2022-28247 on the Adobe Security Bulletin APSB22-16.
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/references
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/adobe
- canonical/adobe acrobat dc
- version/adobe acrobat dc/15.008.20082
- version/adobe acrobat dc/22.001.20085
- canonical/adobe acrobat reader dc
- version/adobe acrobat reader dc/15.008.20082
- version/adobe acrobat reader dc/22.001.20085
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows
- canonical/adobe acrobat reader
- version/adobe acrobat reader/17.011.30059
- version/adobe acrobat reader/17.012.30205
- version/adobe acrobat reader/20.001.30005
- version/adobe acrobat reader/20.005.30314
- version/adobe acrobat reader/20.005.30311